UPSTREAM_PIN

# Deliberately pinned @anthropic-ai/claude-code version for CI's provider
# installs. This is NOT "pin to hold green" — this project's doctrine is to
# never pin to an older upstream just to keep CI quiet. The pin is ONLY what CI
# installs, builds and tests: users' `clode fetch claude` follows upstream's own
# update channel (default `latest`; libexec/clode-update.cjs resolveChannel), so
# the pin is how CI proves what users run.
#
# From 2026-09-01 to 2026-09-26 the pin held at 2.1.251. 2.1.257 broke
# `clode build`'s SCC merger (QuickJS's parser rejects a merged file with
# "invalid property name") on every leg that stages a provider; only
# engine-only cross-build legs still passed. Holding at 2.1.251 was the OTHER
# half of the doctrine — "absorb the change AND make the next absorption
# cheaper" — paid first, not silently avoided by holding still forever. It was
# absorbed on 2026-09-26: the pin moved to 2.1.283, upstream's `latest` and
# `next` that day (`npm view @anthropic-ai/claude-code dist-tags`: stable
# 2.1.274, latest 2.1.283, next 2.1.283).
#
# upstream-drift.yml does NOT read this file: its whole job is noticing that
# upstream moved, so it stays on `next`/unpinned on purpose. See its own
# comment before "fixing" that for consistency with everything else here.
#
# MEASURED EVIDENCE for the pin, so the gap is a dated fact and not a memory
# (every line here is something someone observed, not inferred):
#
#   2.1.251  the pin from 2026-09-01 (585244d) to 2026-09-26. Carved, merged, built and
#            shipped, exercised on every push while it was the pin.
#   2.1.252  `clode build` DIED in the SCC merge on 2026-09-03 (`compiling __clode-scc-2.js
#            failed: invalid property name`; test/provider-resolve.cjs records it). The
#            earliest version measured broken.
#   2.1.257  `clode build` DIED in the SCC merge on 2026-09-01 — QuickJS rejected the
#            merged file with "invalid property name". Every leg that stages a provider
#            went red; only engine-only cross-build legs passed. This is why the pin was
#            set.
#   2.1.261  independently observed uncarvable by our extractor, after native Claude
#            Code auto-updated past the pin mid-session (2026-09-04). Not tried since.
#   2.1.270  anchors and CLI extraction verified OK against the real darwin-arm64
#            bundle on 2026-09-12 (the Remote Control gate anchor was re-pinned that
#            day for its new object-returning shape). The MERGE was not tried: it needs
#            an engine, and nothing then attempted it against newer than the pin (the
#            engine-backed carve probe filed that day landed 2026-09-21, 6032f77).
#
#   2.1.278  CARVES, MERGES AND COMPILES (2026-09-21, darwin-arm64, real engine): staging
#            produced 4 merged groups (8, 4, 61, 4) and all 1958 staged modules compiled
#            under tjs. Not luck we control — see the root cause below. Nothing is claimed
#            here about booting it; only that the step the pin exists for now passes.
#
#   2.1.283  THE PIN since 2026-09-26. CARVES, MERGES AND COMPILES (2026-09-26,
#            darwin-arm64, real engine): scripts/carve-probe.mjs, run while the pin was
#            still 2.1.251, staged 3 merged groups (3, 51, 4; 18 residual requires
#            removed) and compiled all 2193 staged modules under tjs. Its Bun is 1.4.3, as
#            2.1.278's, but another build (revision 7c1d0ed2 where 2.1.278's is 8c28b316).
#            Its text and paint match native 2.1.283 exactly under our shim (1,178,263
#            strings through four consumers, 577 paint ops), so the text oracle moved with
#            it. Carving is not booting, and it did not boot: the first full suite at this
#            pin had 26 failures, from three upstream changes a carve cannot see, each
#            fixed with it (BACKLOG.md, "2.1.283 broke every clode build"): the
#            filesystem asset reader's reworded error (every build's PONG smoke died),
#            woff2 font rows tjs decodes unlike node (the extractor's output differed by
#            184 bytes), and builtin plugins reading import.meta.dir (a naude answered -p
#            with nothing; that one arrived by 2.1.282). A fourth only the live frame gate
#            saw: a built-in plugin's hooks module taking upstream's dev-tree branch, which
#            painted "agents-md: hooks module did not load" into every quaude TUI.
#
# WHAT ACTUALLY BREAKS, measured 2026-09-21 on this box with a real engine, because
# "QuickJS rejects the merged file" was true and told nobody where to look. The merged
# file is not valid ES in ANY engine — node rejects it too ("Invalid or unexpected token")
# — so this was never a QuickJS parser gap. scc-merge.cjs renames colliding top-level
# bindings over a mask that calls these bytes ordinary code, and on 2.1.257 upstream's
# re-chunking put a module carrying BOTH of these into a strongly connected group for the
# first time (group 1 grew 99 -> 114 members):
#
#   \u{b5}s:1000n        ->  \__m28_u{b5}s:1000n        (a unicode escape in an IDENTIFIER;
#                                                        the `u` was renamed inside it)
#   static get rules(){  ->  static __m28_get rules(){   (a getter's member modifier)
#
# Both live in ONE carved module, chunk-1kg58a1a.js, which also declares a genuine
# top-level `function get(...)` and a top-level `u`. The first is what QuickJS reaches
# first, and it is exactly "invalid property name"; the second is caught at merge time
# today by assertNoRenamedFixedNames, which is why a 2.1.257 carve now refuses with the
# ratchet's message instead of the one recorded above. On 2.1.251 and 2.1.278 those two
# sites sit in modules that are NOT in any merged group, so the merger never touches them
# — the defects are LATENT, not fixed, and upstream's next re-chunk can re-trigger them.
#
# CORRECTED 2026-09-26, by measurement: the merger has since learned both spellings
# (libexec/scc-merge.cjs: a unicode escape is part of its identifier; a member-modifier
# CHAIN like `static get` protects the member name). scripts/carve-probe.mjs on the real
# darwin-arm64 2.1.257 now CARVES: 3 merged groups (7, 114, 5), all 1680 staged modules
# compiled under tjs. On 2.1.283 the two sites sit in two modules, chunk-9yjanq6m.js and
# chunk-hzevqd7x.js, neither in a merged group.
#
# So, as measured: "we cannot build from newer" held at .252 (2026-09-03), .257
# (2026-09-01) and .261 (2026-09-04), all before the merger learned those spellings. Since
# then each version tried has carved, merged and compiled (scripts/carve-probe.mjs,
# darwin-arm64, real engine): .251, .252, .257 and .278 on 2026-09-22 (a41df80, 73eb692),
# and on 2026-09-26 .251 and .252 (1839 modules, groups 7/99/5 each), .257 (1680, 7/114/5),
# .274 (1894, 8/4/59/5), .275 (1929, 8/4/60/5), .281 (2084, 3/6/63/4), .282 (2112, 3/51/4)
# and .283 (above). This record holds no carve of the other versions from .253 to .282
# (.270 was only extracted).
#
# THE STANDING ANSWER, kept honest by scripts/carve-probe.mjs (upstream-drift.yml's
# `carve` job). This is the outcome someone MEASURED for newer-than-pin upstream; the
# probe compares each day's real carve+merge+compile against it and goes red on either
# change — it started working, or it fails somewhere/something new. The version is
# context for a reader; the OUTCOME is what is compared. Grammar:
#     carve-probe <version> carves
#     carve-probe <version> blocked <stage> <reason substring>
# The record below was measured on 2.1.283 while it was still newer than the pin (above).
# With the pin at 2.1.283, which was also `next` that day, the probe SKIPS by name ("not
# newer than the pin") until upstream publishes past it, then compares that carve with this.
carve-probe 2.1.283 carves
#
# Bump or drop the pin by editing the version below — one line, one file.
claude-code 2.1.283